afrog - SecurityCipher

A Security Tool for Bug Bounty, Pentest and Red Teaming

What is afrog

afrog is a high-performance security scanning toolkit built for bug bounty, pentest, and red team workflows. It combines fast target probing, built-in vulnerability checks, custom PoC authoring, and SDK-driven automation in a single Go-based workflow.

What afrog does

Fast and focused scanning for web targets and network services
Built-in and custom PoC support for practical security validation
Lower false-positive noise through precise rule design and checks
Flexible integration with Go applications, automation flows, and private PoC pipelines

Install

Dependencies

Go 1.27 or later

Binary release

Download the latest release from:

https://github.com/zan8in/afrog/releases/latest

Build from source

git clone https://github.com/zan8in/afrog.git
cd afrog
go mod tidy
go build -o afrog cmd/afrog/main.go
./afrog -h

Go install

go install -v github.com/zan8in/afrog/v3/cmd/afrog@latest

Quick start

Scan a single target:

afrog -t https://example.com

Scan multiple targets from a file:

afrog -T targets.txt

Run only high and critical checks:

afrog -T targets.txt -S high,critical

Documentation

The documentation is organized into four handbooks:

Handbook	Start here
User Guide	What afrog is and how to use it
PoC Authoring Guide	Write your first PoC
SDK Usage Guide	Embed afrog in your Go program
Curated PoC	Enable licensed curated PoCs

PoC Contributors

_不动明王	_雪山	_White-hua	₁₂₃₄₅₆	_ifofor	_Air	_执着	_purple-WL	_throat
_Secx	_冰河	_Sheen	_a16	_A1	_rainbow2972	_wuha0926	_茄子	_{lei_sec}
_G-H-Z	_wh1te	_清月	_york	_7eleven.eth	_Double...	_{ICEY_}	_lazy	_free2e
_m4sk	_沉默树人	_陈麻子	_leonardo-o1	_{江湖人称魏...}	_若兮风	_-sudo	_Cuerz	_laohuan12138
_exp0l0zzz	_1derian	_CMDB-M	_li1u	_oxsonder	_Zhiliao	_段	_HuiTaiL	_Miracles666
_Observer	_黑熊	_TryA9ain	_fgz00	_Y3y1ng	_二大爷	_Wans	_{海边的小米粥}	_Wen
_SULAB	_ZacharyZcR	_Superhero	_k5rC85Lma

Community

To join the afrog WeChat discussion group, add the afrog account and mark it as afrog.

404Starlink

afrog is part of 404Starlink.

Disclaimer

This tool is intended only for legally authorized security work. Do not scan unauthorized targets. The user is solely responsible for any misuse or illegal activity.